Event Descriptions Missing From Get-EventLog but present in Get-WinEvent and Event Viewer
Many of the event descriptions for event log events are missing when I query them in powershell with Get-EventLog but they are present when I query them in powershell with Get-WinEvent or view them in the regular event viewer eventvwr.msc
Here's the output of Get-EventLog:
PS U:\> Get-EventLog -LogName System -Source Microsoft-Windows-Kernel-Power
Index Time EntryType Source InstanceID Message
----- ---- --------- ------ ---------- -------
11985 Apr 02 13:42 Information Microsoft-Windows... 172 The description for Event ID '172' in Source 'Microsoft-Windo...
11968 Apr 02 13:41 Information Microsoft-Windows... 109 The description for Event ID '109' in Source 'Microsoft-Windo...
11732 Apr 02 09:41 Information Microsoft-Windows... 172 The description for Event ID '172' in Source 'Microsoft-Windo...
11714 Apr 02 09:40 Information Microsoft-Windows... 109 The description for Event ID '109' in Source 'Microsoft-Windo...
10363 Mar 29 14:28 Information Microsoft-Windows... 172 The description for Event ID '172' in Source 'Microsoft-Windo...
10346 Mar 29 14:28 Information Microsoft-Windows... 109 The description for Event ID '109' in Source 'Microsoft-Windo...
Here's a full event:
PS U:\> Get-EventLog -LogName System -Source Microsoft-Windows-Kernel-Power | select -first 1 | fl
Index : 11985
EntryType : Information
InstanceId : 172
Message : The description for Event ID '172' in Source 'Microsoft-Windows-Kernel-Power' cannot be found. The local
computer may not have the necessary registry information or message DLL files to display the message, or you
may not have permission to access them. The following information is part of the event:'2', '6'
Category : (203)
CategoryNumber : 203
ReplacementStrings : {2, 6}
Source : Microsoft-Windows-Kernel-Power
TimeGenerated : 2019-04-02 13:42:01
TimeWritten : 2019-04-02 13:42:01
UserName : NT AUTHORITY\SYSTEM
Here's the output from Get-WinEvent:
PS C:\WINDOWS\system32> Get-WinEvent -LogName System -FilterXPath "<QueryList>
>> <Query Id='0' Path='System'>
>> <Select Path='System'>*[System[Provider[@Name='Microsoft-Windows-Kernel-Power']]]</Select>
>> </Query>
>> </QueryList>"
ProviderName: Microsoft-Windows-Kernel-Power
TimeCreated Id LevelDisplayName Message
----------- -- ---------------- -------
2019-04-02 13:42:01 172 Information Connectivity state in standby: Disconnected, Reason: NIC compliance
2019-04-02 13:41:44 109 Information The kernel power manager has initiated a shutdown transition....
2019-04-02 09:41:08 172 Information Connectivity state in standby: Disconnected, Reason: NIC compliance
2019-04-02 09:40:51 109 Information The kernel power manager has initiated a shutdown transition....
2019-03-29 14:28:26 172 Information Connectivity state in standby: Disconnected, Reason: NIC compliance
2019-03-29 14:28:09 109 Information The kernel power manager has initiated a shutdown transition....
Get-WinEvent is able to render the message "Connectivity state in standby: Disconnected, Reason: NIC compliance" with no problems.
Here's the first event in event viewer with the message displayed properly as well:
The message suggests that the registry or event message dll file might be a problem but I've checked and they aren't:
PS U:\> Get-ItemPropertyValue HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\System\Microsoft-Windows-Kernel-Power -name EventMessageFile
C:\WINDOWS\system32\microsoft-windows-kernel-power-events.dll
PS U:\> test-path C:\WINDOWS\system32\microsoft-windows-kernel-power-events.dll
True
PS U:\> $handle = [System.IO.File]::OpenRead("C:\WINDOWS\system32\microsoft-windows-kernel-power-events.dll")
PS U:\> $handle.CanRead
True
This shows that
- The source is configured in the registry
- The file exists
- I can read the file
This is not isolated to the Microsoft-Windows-Kernel-Power source. The same happens for lots of other event sources. But not all event sources. For example Get-EventLog renders the Microsoft-Windows-Winlogon source messages properly:
PS U:\> Get-EventLog -LogName System -Source Microsoft-Windows-Winlogon | select -first 1 | ft
Index Time EntryType Source InstanceID Message
----- ---- --------- ------ ---------- -------
12100 Apr 02 13:58 Information Microsoft-Windows... 7001 User Logon Notification for Customer Experience Improvement P...
I've already restarted my machine multiple times and I ran the System File Checker and it reported no problems.
Version details:
PS U:\> $PSVersionTable
Name Value
---- -----
PSVersion 5.1.17763.316
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.17763.316
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
I believe you are running into a limitation with the Get-EventLog cmdlet which has been superseded by the Get-WinEvent cmdlet. According to the official documentation:
PowerShell cmdlets that contain the EventLog noun work only on Windows classic event logs such as Application, System, or Security. To get logs that use the Windows Event Log technology in Windows Vista and later Windows versions, use Get-WinEvent.
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1
Although you are querying the System event log which should technically not be affected by this since it is a classic event log, those type of event log entries (that start with Microsoft-Windows-) only started appearing in Vista and later, so I'm pretty sure this is "by design".
I'm honestly not sure why you're not just using the Get-WinEvent cmdlet instead, since that one does work.